Security

SAML AuthnRequest

The XML authentication request a SAML service provider sends, via the user's browser, to an identity provider to ask it to authenticate the user. The identity provider must parse this unauthenticated XML before it can verify who sent it.

Deep dive

Learn Article

How a SAML Login Flow Works and Where an Unauthenticated Request Gets Parsed

A SAML gateway must parse attacker-controlled XML before it can verify any signature. Here is the login flow step by step and the exact points where anonymous input reaches the parser.

intermediate 6 min read

Back to glossary